Privacy Policy

Who we are

Business

Storeroom Rack, trading as Storeroomrack.com, operating in Singapore since 2004.

Address

1092 Lower Delta Road, #06-10, Singapore 169203 (MapleTree Industrial Estate)

Phone

(65) 6372 1581

Data protection contact

hello@storeroomrack.com

What we collect, and when

When you request a quotation

• Your name, phone number and email address.
• The wall measurements of the room you want racked.
• Your delivery address, preferred delivery date and any delivery instructions.
• How you found us.
• Optionally, your company name, office phone number and a description of your requirement.
• Optionally, files you attach — typically a floor plan, a sketch or a photograph of the room.

When you place an order

• Everything above, plus the items you are ordering: product, quantity, shelf configuration and any remarks.
• Your full delivery address, including unit number and postal code.
• Any additional notes you add for the delivery team.

Recorded automatically with a submission

• The date and time the form was submitted.
• The IP address the submission came from, stored with the record so we can investigate abuse or a disputed submission.

When you contact us directly

If you email or call us, we keep what you send us — your message, your contact details, and our reply — so the enquiry can be followed through. Nothing more is collected than what you choose to tell us.

Files you upload

The quotation and order forms accept image files (JPEG, PNG and WebP), PDFs and Word documents, up to 5 MB each. Uploads are renamed to a random filename on our server and filed by month, so the original filename is never used as a web address. They are stored on the same server as the submission and attached to the internal notification email so our team can read them alongside your measurements.

Why we collect it

• To prepare your quotation — measurements and floor plans are the whole basis of a rack size and price.
• To fulfil your order — the delivery address, date and access instructions go to the people making the delivery.
• To contact you — to confirm details, send your order confirmation and answer questions.
• To keep proper business records — orders, invoices and warranty claims.
• To keep the site working safely — spam filtering and rate limiting on public forms.

We do not sell, rent or trade personal data, and we do not use your details for marketing you did not ask for.

Our basis under the PDPA

We rely mainly on your consent. When you fill in a quotation or order form and submit it, you are voluntarily giving us that data for a purpose that is obvious from the form itself — getting a price, or getting a rack delivered — and the PDPA treats that as deemed consent for that purpose. Where you give us a colleague’s business contact details for a corporate order, those are handled as business contact information.

We also keep records where we are legally required to, or where it is necessary to establish or defend a claim about an order. We notify you of the purpose before or at the point of collection, and we use the data only for the purposes set out on this page.

How long we keep it

Quotation enquiries that do not lead to an order are kept only while they are still useful for following up, and then deleted. Records connected to a completed sale — the order, the delivery details and any warranty correspondence — are kept for as long as our accounting, tax and warranty obligations require, and then deleted. Uploaded files are deleted along with the record they belong to.

Who we share it with

• Our delivery team, and any external courier we engage at your request for a faster delivery, receive your name, phone number, delivery address and access instructions.
• Our email provider handles the notification and confirmation emails; the mail server is operated on our own domain.
• Our measurement providers (Google Analytics and Microsoft Clarity) receive how you move around the site — pages viewed, clicks, scrolling — together with your IP address and browser details, as any web request carries. They are not given your name, address, phone number or anything else you type into a form.
• Nobody else. We do not sell personal data, and we do not pass it to advertisers or data brokers.

Your data is stored on servers in Singapore. Where a service provider is outside Singapore, we do not transfer personal data to them without ensuring comparable protection, as the PDPA transfer limitation obligation requires.

Cookies and tracking

The site sets these cookies:

srr_session

A session cookie. It keeps your visit consistent and carries the anti-forgery token that stops someone else’s site from submitting our forms on your behalf. It holds no personal data itself, is marked HttpOnly and SameSite=Lax, is sent only over HTTPS, and expires when you close your browser.

_ga and _ga_…

Set by Google Analytics. They give your browser a random identifier so repeat visits are counted as one person rather than several, and they expire two years after your last visit. They carry no name, address or anything you have typed into a form. Blocking them, or turning on “Do Not Track” in your browser, costs you nothing on this site — nothing here depends on them.

_clck and _clsk

Set by Microsoft Clarity. _clck keeps a random identifier so repeat visits are not counted as new people and expires after a year; _clsk joins the pages of a single visit together and expires the same day. Neither carries your name or anything you have typed.

This site uses Google Analytics to count page views and see which pages people find useful. It records things like the page you are on, roughly where in the world you are, and whether you arrived from a search or a link. It is not used to build a profile of you, it is not used for advertising, and we do not combine it with anything you send us through a form.

If you would rather not be counted, Google publishes a browser add-on that turns it off everywhere: Google Analytics Opt-out Browser Add-on. Most browsers can also block these cookies on their own.

We also use Microsoft Clarity, and it does something different enough to be worth spelling out. Clarity records how you move around a page — where you scroll, what you click, where the pointer goes — and lets us play that back as an anonymous session. We use it to find the parts of the site people get stuck on: a button nobody notices, a table that will not scroll on a phone, a form abandoned halfway through.

What you type is not recorded. Clarity masks the text in form fields before anything leaves your browser, so your name, address, phone number and message are not in the recording — we can see that a field was filled in, not what was put in it. There is no sound, no camera, and nothing that identifies you by name.

Microsoft processes this for us and sets its own cookies, listed above. You can read Microsoft’s privacy statement, and blocking the _clck and _clsk cookies in your browser stops the recording. Nothing on this site needs them to work.

One third party is contacted by your browser regardless: our pages load their typeface from Google Fonts, which means your browser requests a stylesheet and font files from Google’s servers. That request carries your IP address and browser details, as any web request does. We send Google nothing about you beyond that.

How your data is protected

• Form submissions travel over HTTPS.
• Every public form carries an anti-forgery token, a honeypot field and a timing check, so automated submissions are rejected before they are stored.
• Forms are rate limited. The limiter stores nothing but timestamps, in a file named after a one-way SHA-256 hash of the IP address — the address itself is not written into it.
• Submission records and uploaded files sit outside the publicly readable part of the site, and the upload folder cannot execute code.
• Access to submissions is limited to the staff who handle quotations and orders.

No system is perfect. If a breach ever affected your data in a way likely to cause you significant harm, we would notify you and the Personal Data Protection Commission as the PDPA requires.

Your rights under the PDPA

• Access — ask what personal data we hold about you and how it has been used or disclosed in the past year.
• Correction — ask us to correct anything inaccurate or incomplete.
• Withdraw consent — tell us to stop using your data for a purpose. We will explain the likely consequence first, since we cannot deliver an order without a delivery address.

Send any of these requests to hello@storeroomrack.com. We will respond as soon as we reasonably can, and let you know if we need more time or more information to identify your record. There is no charge for a straightforward request.

Children

This site is aimed at adults buying storage for a home or a business. We do not knowingly collect personal data from children, and we have no reason to ask for it.

Changes to this policy

When we change how we handle personal data, we update this page and change the date at the top. The version published here is always the one that applies. It sits alongside our terms and conditions, which govern the orders themselves.

Contact us about your data

Email hello@storeroomrack.com, call (65) 6372 1581 during office hours, or write to us at the address above. Our contact page has directions and opening times.